aidimag 1.0.11 → 1.0.12

package/dist/cli/commands/sync.js

@@ -37,7 +37,7 @@ export function registerSyncCommands(program) {
         .option("--full", "Include full remote payload JSON (remote)")
         .action(async (action, opts) => {
         const root = findRepoRoot() ?? fail("not inside a repo");
-        const { readCloudConfig, writeCloudConfig, saveToken, getToken, fetchRemoteSnapshot, syncMetaKey } = await import("../../sync/client.js");
+        const { readCloudConfig, writeCloudConfig, getToken, fetchRemoteSnapshot, syncMetaKey } = await import("../../sync/client.js");
         switch (action) {
             case "link": {
                 if (!opts.server || !opts.brain)
@@ -165,7 +165,9 @@ export function registerSyncCommands(program) {
         .action(async (opts) => {
         const { readCloudConfig, startDeviceLogin, pollDeviceLogin } = await import("../../sync/client.js");
         const root = findRepoRoot();
-        const server = opts.server?.replace(/\/$/, "") ?? (root ? readCloudConfig(root)?.server : undefined);
+        if (!root)
+            fail("not inside a repo — run this command from a project directory");
+        const server = opts.server?.replace(/\/$/, "") ?? readCloudConfig(root)?.server;
         if (!server)
             fail("no server: pass --server <url> or link the repo with `dim cloud link` first");
         const start = await startDeviceLogin(server);
@@ -174,20 +176,50 @@ export function registerSyncCommands(program) {
         if (opts.open)
             await openBrowser(approveUrl);
         console.log("Waiting for approval…");
-        const { brain } = await pollDeviceLogin(server, start);
-        console.log(`✓ Logged in to ${server} (scope: ${brain ?? "all brains"}). Token saved to ~/.aidimag/credentials.json.`);
+        const { token, brain } = await pollDeviceLogin(server, start);
+        // Save token to project config
+        const p = configPath(root);
+        let existing = {};
+        try {
+            existing = JSON.parse(readFileSync(p, "utf8"));
+        }
+        catch {
+            // fresh file
+        }
+        existing.token = token;
+        writeFileSync(p, JSON.stringify(existing, null, 2) + "\n");
+        console.log(`✓ Logged in to ${server} (scope: ${brain ?? "all brains"}).`);
+        console.log(`✓ Token saved to .aidimag/config.json (per-project).`);
+        console.log(`⚠ Add .aidimag/config.json to .gitignore if you don't want to commit the token.`);
     });
     program
         .command("logout")
-        .description("Remove this device's stored token for the sync server")
-        .option("-s, --server <url>", "Server URL (defaults to the repo's linked server)")
+        .description("Remove this device's stored token from the project config")
         .action(async (opts) => {
-        const { readCloudConfig, removeToken } = await import("../../sync/client.js");
+        const { readCloudConfig } = await import("../../sync/client.js");
         const root = findRepoRoot();
-        const server = opts.server?.replace(/\/$/, "") ?? (root ? readCloudConfig(root)?.server : undefined);
-        if (!server)
-            fail("no server: pass --server <url> or link the repo with `dim cloud link` first");
-        console.log(removeToken(server) ? `✓ Logged out of ${server}.` : `No stored token for ${server}.`);
+        if (!root)
+            fail("not inside a repo — run this command from a project directory");
+        const cfg = readCloudConfig(root);
+        if (!cfg)
+            fail("not cloud-linked. Use `dim cloud link` first");
+        // Remove token from project config
+        const p = configPath(root);
+        let existing = {};
+        try {
+            existing = JSON.parse(readFileSync(p, "utf8"));
+        }
+        catch {
+            console.log("No config file found.");
+            return;
+        }
+        if (!existing.token) {
+            console.log("No token stored in this project.");
+            return;
+        }
+        delete existing.token;
+        writeFileSync(p, JSON.stringify(existing, null, 2) + "\n");
+        console.log(`✓ Logged out — token removed from .aidimag/config.json`);
     });
     program
         .command("sync")

package/dist/cli/commands/tickets.js

@@ -61,12 +61,12 @@ export function registerTicketCommands(program) {
                         });
                         console.log(`🎫 Connected via the team sync server (${cloud.server}, brain: ${cloud.brain}).`);
                         console.log(`   Zero local ticket credentials — the server holds the team token.`);
-                        if (!getToken(cloud.server))
+                        if (!getToken(cloud.server, root))
                             console.log(`   ⚠ No sync token on this machine yet — run \`dim login\` first.`);
                         // trust-building: check the server actually has a team config
                         try {
                             const res = await fetch(`${cloud.server}/v1/ticket-config?brain=${encodeURIComponent(cloud.brain)}`, {
-                                headers: { Authorization: `Bearer ${getToken(cloud.server) ?? ""}` },
+                                headers: { Authorization: `Bearer ${getToken(cloud.server, root) ?? ""}` },
                             });
                             const body = (await res.json());
                             if (res.ok && body.config?.provider) {
@@ -150,7 +150,7 @@ export function registerTicketCommands(program) {
                 if (cfg.provider === "remote") {
                     const { readCloudConfig, getToken } = await import("../../sync/client.js");
                     const cloud = readCloudConfig(root);
-                    console.log(`provider: remote (via the team sync server)\nserver:   ${cloud?.server ?? "NOT LINKED — dim cloud link"}\nbrain:    ${cloud?.brain ?? "—"}\npattern:  ${cfg.pattern ?? tickets.DEFAULT_TICKET_PATTERN}\ntoken:    ${cloud && getToken(cloud.server) ? "sync token stored" : "MISSING — dim login"}`);
+                    console.log(`provider: remote (via the team sync server)\nserver:   ${cloud?.server ?? "NOT LINKED — dim cloud link"}\nbrain:    ${cloud?.brain ?? "—"}\npattern:  ${cfg.pattern ?? tickets.DEFAULT_TICKET_PATTERN}\ntoken:    ${cloud && getToken(cloud.server, root) ? "sync token stored" : "MISSING — dim login"}`);
                 }
                 else {
                     const credKey = cfg.baseUrl ?? "linear";

package/dist/sync/client.d.ts

@@ -21,8 +21,6 @@ export declare function configPath(repoRoot: string): string;
 export declare function readCloudConfig(repoRoot: string): CloudConfig | null;
 export declare function writeCloudConfig(repoRoot: string, cfg: CloudConfig): void;
 export declare function getToken(server: string, repoRoot?: string): string | null;
-export declare function saveToken(server: string, token: string): void;
-export declare function removeToken(server: string): boolean;
 export interface DeviceStart {
     device_code: string;
     user_code: string;
@@ -32,7 +30,7 @@ export interface DeviceStart {
 }
 /** Begin a device-code login: server hands back a user code + approval URL. */
 export declare function startDeviceLogin(server: string): Promise<DeviceStart>;
-/** Poll until the device is approved in the browser. Saves the token on success. */
+/** Poll until the device is approved in the browser. Returns the token (caller must save it). */
 export declare function pollDeviceLogin(server: string, start: DeviceStart): Promise<{
     token: string;
     brain: string | null;

package/dist/sync/client.js

@@ -9,8 +9,7 @@
  *   .aidimag/config.json { server, brain, token } — per-project, add to .gitignore if token is sensitive
  *   AIDIMAG_API_KEY env var — alternative to storing token in config
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
-import { homedir } from "node:os";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { debugLog } from "../debug.js";
 const CURSOR_KEY = "sync_pull_cursor";
@@ -52,9 +51,6 @@ export function writeCloudConfig(repoRoot, cfg) {
     const brain = cfg.brain.trim();
     writeFileSync(p, JSON.stringify({ ...existing, server, brain }, null, 2) + "\n");
 }
-function credentialsPath() {
-    return path.join(homedir(), ".aidimag", "credentials.json");
-}
 export function getToken(server, repoRoot) {
     if (process.env.AIDIMAG_API_KEY)
         return process.env.AIDIMAG_API_KEY;
@@ -74,28 +70,6 @@ export function getToken(server, repoRoot) {
     }
     return null;
 }
-export function saveToken(server, token) {
-    const p = credentialsPath();
-    mkdirSync(path.dirname(p), { recursive: true });
-    const creds = existsSync(p) ? JSON.parse(readFileSync(p, "utf8")) : {};
-    creds[server] = token;
-    writeFileSync(p, JSON.stringify(creds, null, 2) + "\n", { mode: 0o600 });
-    try {
-        chmodSync(p, 0o600);
-    }
-    catch { /* best-effort on Windows */ }
-}
-export function removeToken(server) {
-    const p = credentialsPath();
-    if (!existsSync(p))
-        return false;
-    const creds = JSON.parse(readFileSync(p, "utf8"));
-    if (!(server in creds))
-        return false;
-    delete creds[server];
-    writeFileSync(p, JSON.stringify(creds, null, 2) + "\n", { mode: 0o600 });
-    return true;
-}
 /** Begin a device-code login: server hands back a user code + approval URL. */
 export async function startDeviceLogin(server) {
     const res = await cloudFetch(server, `${server}/v1/auth/device`, { method: "POST" });
@@ -106,7 +80,7 @@ export async function startDeviceLogin(server) {
     }
     return (await res.json());
 }
-/** Poll until the device is approved in the browser. Saves the token on success. */
+/** Poll until the device is approved in the browser. Returns the token (caller must save it). */
 export async function pollDeviceLogin(server, start) {
     const deadline = Date.now() + start.expires_in * 1000;
     for (;;) {
@@ -123,7 +97,6 @@ export async function pollDeviceLogin(server, start) {
         if (!res.ok)
             throw new Error(`login failed: HTTP ${res.status} ${await res.text()}`);
         const out = (await res.json());
-        saveToken(server, out.token);
         return out;
     }
 }
@@ -396,7 +369,7 @@ export async function maybeAutoSync(store, repoRoot) {
     const cfg = readCloudConfig(repoRoot);
     if (!cfg)
         return null;
-    if (!getToken(cfg.server))
+    if (!getToken(cfg.server, repoRoot))
         return null;
     const last = store.getMeta(AUTO_SYNC_LAST_KEY);
     if (last && Date.now() - new Date(last).getTime() < AUTO_SYNC_DEBOUNCE_MS)

package/dist/tickets/provider.js

@@ -321,9 +321,7 @@ export function ticketProviderFor(repoRoot) {
             const raw = JSON.parse(readFileSync(p, "utf8"));
             if (!raw.server || !raw.brain)
                 return null;
-            const token = process.env.AIDIMAG_API_KEY ??
-                JSON.parse(readFileSync(credentialsPath(), "utf8"))[raw.server] ??
-                null;
+            const token = process.env.AIDIMAG_API_KEY ?? raw.token ?? null;
             return token ? new RemoteProvider(raw.server, raw.brain, token) : null;
         }
         catch {

package/dist/ui/server.js

@@ -7,13 +7,13 @@
  * same dashboard in a webview.
  */
 import { createServer } from "node:http";
-import { watch, mkdirSync } from "node:fs";
+import { watch, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { verifyAll } from "../verify/engine.js";
 import { mineCommits } from "../capture/commit-miner.js";
 import { hybridSearch, indexMemory, reindexAll } from "../embeddings/search.js";
-import { readCloudConfig, writeCloudConfig, saveToken, getToken, sync as cloudSync } from "../sync/client.js";
+import { readCloudConfig, writeCloudConfig, getToken, sync as cloudSync, configPath } from "../sync/client.js";
 import { resolveKnowledgeConfig } from "../config.js";
 import { ingestAll } from "../knowledge/ingest.js";
 import { isAllowedSyncServerUrl } from "../security/url.js";
@@ -65,7 +65,7 @@ export function startUiServer(store, repoRoot, port = 4517) {
     if (autoSyncMinutes > 0) {
         const timer = setInterval(() => {
             const cloud = readCloudConfig(repoRoot);
-            if (!cloud || !getToken(cloud.server))
+            if (!cloud || !getToken(cloud.server, repoRoot))
                 return;
             cloudSync(store, repoRoot).catch(() => undefined);
         }, autoSyncMinutes * 60 * 1000);
@@ -136,7 +136,7 @@ export function startUiServer(store, repoRoot, port = 4517) {
                     proposals: store.listProposals("PENDING", 200),
                     summary: store.statusSummary(),
                     cloud: cloud
-                        ? { server: cloud.server, brain: cloud.brain, hasToken: !!getToken(cloud.server) }
+                        ? { server: cloud.server, brain: cloud.brain, hasToken: !!getToken(cloud.server, repoRoot) }
                         : null,
                     tickets: tcfg.provider
                         ? {
@@ -144,7 +144,7 @@ export function startUiServer(store, repoRoot, port = 4517) {
                             baseUrl: tcfg.baseUrl ?? null,
                             pattern: tcfg.pattern ?? DEFAULT_TICKET_PATTERN,
                             hasCredential: tcfg.provider === "remote"
-                                ? !!(cloud && getToken(cloud.server))
+                                ? !!(cloud && getToken(cloud.server, repoRoot))
                                 : !!getTicketCredential(tcfg.baseUrl ?? "linear"),
                             branch: tcfg.branch ?? null,
                         }
@@ -232,10 +232,21 @@ export function startUiServer(store, repoRoot, port = 4517) {
                     json(res, 400, { error: "invalid server URL" });
                     return;
                 }
-                writeCloudConfig(repoRoot, { server: serverUrl, brain: String(b.brain) });
-                if (b.token)
-                    saveToken(serverUrl, String(b.token));
-                json(res, 200, { ok: true, hasToken: !!getToken(serverUrl) });
+                // Save to project config with token
+                const p = configPath(repoRoot);
+                let existing = {};
+                try {
+                    existing = JSON.parse(readFileSync(p, "utf8"));
+                }
+                catch {
+                    // fresh file
+                }
+                const newConfig = { ...existing, server: serverUrl, brain: String(b.brain) };
+                if (b.token) {
+                    newConfig.token = String(b.token);
+                }
+                writeFileSync(p, JSON.stringify(newConfig, null, 2) + "\n");
+                json(res, 200, { ok: true, hasToken: !!getToken(serverUrl, repoRoot) });
                 return;
             }
             if (req.method === "POST" && path === "/api/cloud/unlink") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aidimag",
-  "version": "1.0.11",
+  "version": "1.0.12",
   "description": "Persistent, verified memory for AI coding agents. CLI: dim.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",